Free Checklist · PDF
HIPAA Security Checklist for Dental & Medical Practices
A one-page checklist of ten technical safeguards for dental and medical practices that handle electronic protected health information (ePHI), mapped to the HIPAA Security Rule (45 CFR 164.308 and 164.312).
Who this checklist is for
Dental practices, DSOs, and medical and specialty clinics that run practice-management or EHR systems, imaging, and third-party lab or clearinghouse portals.
What's inside
The checklist is a one-page PDF with ten controls. Each has a Pass / Gap box so you can mark it up in a team meeting:
- Security risk analysis (45 CFR 164.308(a)(1)(ii)(A)). Keep an up-to-date inventory and risk register for every workstation, server, imaging sensor, and cloud portal that touches ePHI.
- Third-party portal access. Eliminate shared logins on lab, clearinghouse, and referral portals, remove former staff promptly, and review access quarterly.
- Phishing-resistant MFA on email. Protect the Microsoft 365 or Google Workspace mailboxes that receive portal and password-reset links.
- Network segmentation for imaging and devices. Separate CBCT, DICOM/PACS, and X-ray workstations from front-desk payment terminals and guest Wi-Fi.
- Backup and recovery for PMS/EHR. Test failover and restoration of systems like Dentrix, Eaglesoft, Open Dental, eClinicalWorks, or athenahealth on a schedule.
- 24/7 endpoint and identity monitoring. Detect and isolate ransomware activity on clinical endpoints quickly.
- Business Associate Agreements. Keep signed BAAs, with breach-notification terms, for your IT provider, cloud backup, VoIP, and imaging vendors.
- Payment card isolation (PCI DSS v4.0.1). Keep card and HSA/FSA terminals on a segmented network with no path to ePHI systems.
- Audit controls (45 CFR 164.312(b)). Log and review activity such as bulk patient exports, login anomalies, and privilege changes.
- Incident response tabletop and phishing drills. Run and document an annual exercise with practice managers and providers.
How to read it
- Items that mention a 72-hour restoration requirement or mandatory MFA and segmentation reflect HHS's proposed Security Rule changes (the January 2025 NPRM), which are not final as of October 2026. The current Security Rule remains in force, and these items are strong recommended practices under it.
- Recovery-time targets such as "under 15 minutes" are Emry's service targets, not HIPAA requirements.
- PCI DSS applies to how you take card payments, separately from HIPAA.
This checklist is an educational self-check, not legal advice, a certification, or a formal assessment. Confirm requirements against the current regulation, your contracts, and your assessor or counsel.
Download
Download the PDF checklist (1 page) →
Related resources
Get audit ready now
Schedule your compliance readiness assessment with our team today.